Ubuntu 26.04 LTS OpenSSL Critical Denial of Service Vuln USN-8414-1

ubuntu

June 9, 2026

Several security issues were fixed in OpenSSL.

Summary

Several security issues were fixed in OpenSSL.

Software Description:

- openssl: Secure Socket Layer (SSL) cryptographic library and tools

Details:

Frank Buss discovered that OpenSSL had a heap buffer over-read in ASN.1

content parsing. An attacker could possibly use this issue to cause OpenSSL

to crash, resulting in a denial of service, or obtain sensitive

information. (CVE-2026-34180)

Pavol Zacik and Alex Gaynor discovered that OpenSSL incorrectly accepted

PKCS#12 files with short HMAC keys when using PBMAC1. An attacker could

possibly use this issue to bypass integrity checks. This issue only

affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-34181)

Asim Viladi Oglu Manizada and Alex Gaynor discovered that OpenSSL could

accept forged CMS AuthEnvelopedData messages. An attacker could possibly

use this issue to bypass message authentication checks. (CVE-2026-34182)

Abhinav Agarwal discovered that OpenSSL had unbounded memory growth in the

QUIC PATH_CHALLENGE handler. A rem...

Read the Full Advisory

Topics Covered

security advisory denial of service critical Ubuntu OpenSSL information disclosure

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  libssl3t64                      3.5.5-1ubuntu3.2
  openssl                         3.5.5-1ubuntu3.2

Ubuntu 25.10
  libssl3t64                      3.5.3-1ubuntu3.4
  openssl                         3.5.3-1ubuntu3.4

Ubuntu 24.04 LTS
  libssl3t64                      3.0.13-0ubuntu3.11
  openssl                         3.0.13-0ubuntu3.11

Ubuntu 22.04 LTS
  libssl3                         3.0.2-0ubuntu1.25
  openssl                         3.0.2-0ubuntu1.25

After a standard system update you need to reboot your computer to make all
the necessary changes.